Local privilege escalation via unlocked kgd_mem pointer

Use-after-free in the Linux kernel amdkfd component allows local users to execute arbitrary kernel code through /dev/kfd ioctls. The map and unmap handlers release p->mutex before amdgpu_amdkfd_gpuvm_sync_memory finishes using a translated kgd_mem pointer, allowing a concurrent free ioctl to reclaim the buffer object. Access to /dev/kfd on an AMD GPU system is required; an ordinary local user can control the race to escalate privileges or repeatedly trigger kernel panics.